Data processing agreement
Updated 27 October 2026.
1. Parties and roles
This agreement is part of the terms of service between the Customer and CodeAPIness SHPK, tax ID (NIPT) M12305008A, at Rruga "Sotir Çaçi", Njësia Bashkiake nr. 3, Tirana (the "Processor"). For the personal data the Customer puts in Dirigo, or that arises from its use, the Customer is the controller and we are the processor. It applies under Albanian personal data protection law and, where applicable, Regulation (EU) 2016/679 (GDPR).
2. Subject and duration
We process personal data only to provide Dirigo to the Customer: showing and playing content on its screens, the panel, screen monitoring and alerts. Processing lasts as long as the subscription, plus the deletion periods in the privacy policy.
3. Data and data subjects
- Panel users (the Customer's staff): name, email, role, locations.
- People in the Customer's content: faces or names in images and videos, voices in announcements.
- Screenshots the Customer requests, which may show that content.
Dirigo is not meant for special categories of data; the Customer does not put them on screens without a legal basis.
4. Our obligations
- We process only on the Customer's instructions, which are these terms and its actions in the panel. If an instruction seems unlawful to us, we tell the Customer.
- Everyone with access to the data is bound by confidentiality.
- We keep the security measures in section 8 of the privacy policy: HTTPS, encrypted tokens, separation of each customer's data, revocable device credentials.
- We help the Customer answer requests from people exercising their rights.
- We notify the Customer without undue delay, and no later than 48 hours after we learn of it, of any security breach affecting its data, with what we know at that point.
- At the end of the subscription, as the Customer chooses, we return or delete the data, except what the law requires us to keep.
- We give the Customer the information it needs to show that this agreement is respected.
5. Sub-processors
The Customer authorises the sub-processors in section 5 of the privacy policy: Hetzner Online GmbH, Cloudflare, Inc. and Sendinblue SAS (Brevo). We notify the Customer of a new sub-processor by email 30 days in advance; if the Customer objects with reason, it may end the subscription before that date. We require the same data protection obligations from sub-processors.
Google Drive is the Customer's own account; Google is not our sub-processor for the content.
6. Transfers abroad
Data is stored in the European Union. When a sub-processor processes it outside the EU, we rely on the European Commission's standard contractual clauses or an adequacy decision.